@codyswann/lisa 2.279.2 → 2.281.0

package/dist/cli/doctor-readiness-guardrails.js

@@ -0,0 +1,219 @@
+/**
+ * The feedback/guardrails readiness producer — ship blocker B4 (PRD #1739,
+ * #1896).
+ *
+ * Dimension 5 of the `readiness-rubric` asks whether a failing loop produces a
+ * named outcome and a runbook. B4 asks the operational half: does every
+ * irreversible or expensive operation have a gate AND a way back?
+ *
+ * Only part of that is answerable offline, and saying so plainly is the point.
+ * Whether a declared GitHub `environment:` actually carries protection rules —
+ * required reviewers, wait timers, branch restrictions — lives in the GitHub API,
+ * not in any file this producer can read. That half is therefore a **stated
+ * SKIP in every record emitted here**, never a guess in either direction.
+ *
+ * What remains is a narrow, file-provable subset: a job that runs an
+ * irreversible or expensive operation with **no `environment:` key at all**, no
+ * `if:` gate, reachable from an automated trigger, in a repository that checks
+ * in no runbook. Only that stands B4. Everything else — an ordinary `cdk
+ * deploy`, a CI-database migration, a job that names any environment, a reusable
+ * workflow whose caller is invisible — is an observation at most, because a
+ * standing blocker flips the whole repository to `NOT_READY` and `WARN` does not
+ * soften that.
+ * @module cli/doctor-readiness-guardrails
+ */
+import { describeCommands, hasCheckedInRunbook, looksEphemeral, scanCommands, } from "./doctor-readiness-operations.js";
+import { informationalFindings } from "./doctor-readiness-shared.js";
+import { parseRepositoryWorkflows, } from "./doctor-readiness-workflows.js";
+/** The feedback/guardrails readiness dimension id (readiness-rubric, RRR-1). */
+export const FEEDBACK_GUARDRAILS_DIMENSION_ID = "feedback-guardrails";
+/** The ship blocker for a consequential operation with no gate and no recovery. */
+const GUARDRAILS_BLOCKER_ID = "B4";
+/** Most operations quoted in one finding before summarizing the remainder. */
+const MAX_EVIDENCE_COMMANDS = 10;
+/**
+ * The half of B4 no offline read can settle, stated in every record this
+ * producer emits so an operator is never left to infer that a declared
+ * environment was checked for protection rules. It was not.
+ */
+const PROTECTION_RULES_SKIP_REASON = "Whether a declared `environment:` actually gates anything — required " +
+    "reviewers, wait timers, branch restrictions — is a GitHub environment " +
+    "protection rule, which lives in the GitHub API and is not resolvable " +
+    "offline. That half of this question was deliberately not assessed; only the " +
+    "file-provable half (an irreversible or expensive operation with no " +
+    "`environment:` key at all and no checked-in runbook) was.";
+/**
+ * Operations that are irreversible or expensive enough that running them
+ * unattended is a decision, not a detail. `cdk deploy` and a plain `terraform
+ * apply` are absent on purpose: they are how normal delivery works, and a
+ * blocker that fires on normal delivery is a blocker nobody will believe.
+ */
+const CONSEQUENTIAL_OPS = [
+    /\bterraform\s+(\S+\s+)*apply\b[^\n]*-auto-approve\b/,
+    /\bterraform\s+(\S+\s+)*destroy\b/,
+    /\bcdk\s+destroy\b/,
+    /\bpulumi\s+destroy\b/,
+    /\bpulumi\s+up\b[^\n]*--yes\b/,
+    /\bserverless\s+remove\b/,
+];
+/**
+ * Commands that apply schema migrations, in the ecosystems Lisa templates. The
+ * `(?!:)` lookahead keeps the read-only subcommands out: `db:migrate:status`
+ * and `db:migrate:version` report what has run, they do not run anything.
+ */
+const MIGRATION_COMMANDS = [
+    /\bdb:migrate\b(?!:)/,
+    /\bmigrate\s+deploy\b/,
+    /\bmigration:run\b/,
+    /\balembic\s+upgrade\b/,
+];
+/**
+ * Markers that a command explicitly targets production. A migration is only
+ * consequential when the file itself says it runs against production: the same
+ * command against a CI service container is ordinary test setup, and treating
+ * the two alike is the false positive that would discredit this whole check.
+ */
+const PRODUCTION_MARKERS = [
+    /\b(rails_env|node_env|app_env|django_settings_module|environment)=[^\s]*prod/,
+    /--env(ironment)?[= ]prod/,
+    /\bprod(uction)?\.tfvars\b/,
+];
+/**
+ * Whether a command is an irreversible or expensive operation.
+ *
+ * The ephemeral screen is the same one B1 uses, widened to the per-pull-request
+ * markers this blocker meets constantly: tearing down `pr-1234` or a
+ * `PreviewStack` destroys what the same pipeline built minutes earlier, and
+ * there is nothing durable there for a gate to protect. The job's `env:` block
+ * is read alongside the command, since the stage name usually lives there.
+ * @param command - The lower-cased `run` command
+ * @param job - The job the command runs in
+ * @returns True when the command is consequential on its face
+ */
+function isConsequential(command, job) {
+    if (looksEphemeral(`${command}\n${job.env}`)) {
+        return false;
+    }
+    return (CONSEQUENTIAL_OPS.some(pattern => pattern.test(command)) ||
+        (MIGRATION_COMMANDS.some(pattern => pattern.test(command)) &&
+            PRODUCTION_MARKERS.some(pattern => pattern.test(command))));
+}
+/**
+ * Triggers that fire on the lifecycle of a short-lived resource rather than on
+ * a release. A workflow that runs on a closing pull request or a deleted branch
+ * is tearing down what that branch created.
+ */
+const EPHEMERAL_LIFECYCLE_EVENTS = [
+    "pull_request",
+    "pull_request_target",
+    "delete",
+];
+/**
+ * State why a workflow driven by a branch or pull-request lifecycle cannot be
+ * settled offline. This is deferred rather than cleared: the operation is real,
+ * but whether it touches anything durable is not provable from the file.
+ * @param workflow - The workflow to consider
+ * @returns A stated reason, or null when the trigger is a release-style one
+ */
+function lifecycleDeferral(workflow) {
+    const events = workflow.on.events.filter(event => EPHEMERAL_LIFECYCLE_EVENTS.includes(event));
+    if (events.length === 0) {
+        return null;
+    }
+    return (`\`${workflow.file}\` runs a consequential operation on the \`${events.join(", ")}\` ` +
+        "lifecycle, which tears down what that same branch or pull request created, " +
+        "so whether it ever touches a durable environment is not established " +
+        "either way — no gate was expected and none was required");
+}
+/**
+ * Build the rubric-shaped B4 finding from the operations it cites.
+ * @param scan - The consequential-operation scan
+ * @returns The B4 finding
+ */
+function guardrailsFinding(scan) {
+    return {
+        blocker: GUARDRAILS_BLOCKER_ID,
+        invariant_violated: "every irreversible or expensive operation has a gate before it and a " +
+            "way back after it",
+        evidence: describeCommands(scan.ungated, MAX_EVIDENCE_COMMANDS),
+        why_proof_missed: "the job declares no `environment:` at all, so there is nothing for a " +
+            "protection rule to attach to and nothing for an operator to approve — " +
+            "and with no runbook checked in, the first time anyone works out how to " +
+            "undo the operation is while it is already failing",
+        root_correction: "declare an `environment:` on the job so a protection rule can gate it, " +
+            "and check in a runbook naming the recovery procedure and the run " +
+            "outcome the loop reports, per the `automation-runbook-contract` rule",
+        machinery_to_remove: [
+            "auto-approval flags that exist only because no approval gate was ever " +
+                "configured for the environment the job deploys to",
+        ],
+    };
+}
+/**
+ * Build the SKIP record. Its first finding always states the network-bound half
+ * that was not assessed; the observations below it carry whatever consequential
+ * operations were found to be already gated.
+ * @param scan - The consequential-operation scan
+ * @param inspected - How many workflow files were read
+ * @param runbook - Whether a runbook is checked in
+ * @returns The SKIP dimension record
+ */
+function skipRecord(scan, inspected, runbook) {
+    return {
+        id: FEEDBACK_GUARDRAILS_DIMENSION_ID,
+        status: "SKIP",
+        findings: [
+            {
+                reason: `Read ${inspected} workflow file(s) for irreversible or expensive ` +
+                    "operations and found none that this file alone proves runs " +
+                    `unattended with no gate and no way back (recovery runbook ` +
+                    `${runbook ? "present" : "absent"}). ${PROTECTION_RULES_SKIP_REASON}`,
+                skip: true,
+            },
+            ...informationalFindings([
+                ...scan.gated.map(entry => `\`${entry.workflow}\` job \`${entry.jobId}\` runs a consequential ` +
+                    `operation (\`${entry.command}\`) behind a declared environment, an ` +
+                    "`if:` condition, its own confirmation switch, or in a repository " +
+                    "that checks in a recovery runbook, so it was not treated as " +
+                    "ungated and unrecoverable — whether any such gate carries " +
+                    "protection rules was not checked"),
+                ...scan.unresolved,
+            ]),
+        ],
+    };
+}
+/**
+ * Assess the feedback/guardrails dimension: B4, "a consequential operation has
+ * no gate and no recovery". Offline by construction, and honest about it — the
+ * environment-protection-rule half is reasoned-SKIPped in every record, so this
+ * dimension never reports `PASS`. B4 stands only on the file-provable subset.
+ * @param root - Project root to assess
+ * @param parsedWorkflows - Pre-parsed workflows (default: parse `root`)
+ * @returns The feedback/guardrails dimension record
+ */
+export async function assessFeedbackGuardrailsDimension(root, parsedWorkflows) {
+    const workflows = parsedWorkflows ?? (await parseRepositoryWorkflows(root));
+    const scan = scanCommands(workflows, isConsequential, {
+        unresolvedWorkflow: lifecycleDeferral,
+    });
+    const runbook = await hasCheckedInRunbook(root);
+    if (scan.ungated.length === 0 || runbook) {
+        return skipRecord(runbook ? { ...scan, gated: [...scan.gated, ...scan.ungated] } : scan, workflows.length, runbook);
+    }
+    return {
+        id: FEEDBACK_GUARDRAILS_DIMENSION_ID,
+        // `WARN` reports how much confidence an offline read can carry; it does NOT
+        // soften the verdict. The blocker engine never reads this status.
+        status: "WARN",
+        findings: [
+            guardrailsFinding(scan),
+            // The unassessable half must travel with the standing blocker too:
+            // dropping it here would let a reader believe the gate was checked.
+            ...informationalFindings([
+                PROTECTION_RULES_SKIP_REASON,
+                ...scan.unresolved,
+            ]),
+        ],
+    };
+}
+//# sourceMappingURL=doctor-readiness-guardrails.js.map

package/dist/cli/doctor-readiness-guardrails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-guardrails.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EAEd,YAAY,GACb,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAGL,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AAEzC,gFAAgF;AAChF,MAAM,CAAC,MAAM,gCAAgC,GAAG,qBAAqB,CAAC;AAEtE,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEnC,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;GAIG;AACH,MAAM,4BAA4B,GAChC,uEAAuE;IACvE,wEAAwE;IACxE,uEAAuE;IACvE,8EAA8E;IAC9E,qEAAqE;IACrE,2DAA2D,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,iBAAiB,GAAsB;IAC3C,qDAAqD;IACrD,kCAAkC;IAClC,mBAAmB;IACnB,sBAAsB;IACtB,8BAA8B;IAC9B,yBAAyB;CAC1B,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GAAsB;IAC5C,qBAAqB;IACrB,sBAAsB;IACtB,mBAAmB;IACnB,uBAAuB;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kBAAkB,GAAsB;IAC5C,8EAA8E;IAC9E,0BAA0B;IAC1B,2BAA2B;CAC5B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,OAAe,EAAE,GAAsB;IAC9D,IAAI,cAAc,CAAC,GAAG,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CACL,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxD,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,0BAA0B,GAAsB;IACpD,cAAc;IACd,qBAAqB;IACrB,QAAQ;CACT,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,QAAwB;IACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC/C,0BAA0B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC3C,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,KAAK,QAAQ,CAAC,IAAI,8CAA8C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACtF,6EAA6E;QAC7E,sEAAsE;QACtE,yDAAyD,CAC1D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAmB;IAC5C,OAAO;QACL,OAAO,EAAE,qBAAqB;QAC9B,kBAAkB,EAChB,uEAAuE;YACvE,mBAAmB;QACrB,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC;QAC/D,gBAAgB,EACd,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,mDAAmD;QACrD,eAAe,EACb,yEAAyE;YACzE,mEAAmE;YACnE,sEAAsE;QACxE,mBAAmB,EAAE;YACnB,wEAAwE;gBACtE,mDAAmD;SACtD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CACjB,IAAmB,EACnB,SAAiB,EACjB,OAAgB;IAEhB,OAAO;QACL,EAAE,EAAE,gCAAgC;QACpC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM,EACJ,QAAQ,SAAS,kDAAkD;oBACnE,6DAA6D;oBAC7D,4DAA4D;oBAC5D,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,4BAA4B,EAAE;gBACvE,IAAI,EAAE,IAAI;aACX;YACD,GAAG,qBAAqB,CAAC;gBACvB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CACf,KAAK,CAAC,EAAE,CACN,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,KAAK,0BAA0B;oBACpE,gBAAgB,KAAK,CAAC,OAAO,wCAAwC;oBACrE,mEAAmE;oBACnE,8DAA8D;oBAC9D,4DAA4D;oBAC5D,kCAAkC,CACrC;gBACD,GAAG,IAAI,CAAC,UAAU;aACnB,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,IAAY,EACZ,eAA2C;IAE3C,MAAM,SAAS,GACb,eAAe,IAAI,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,eAAe,EAAE;QACpD,kBAAkB,EAAE,iBAAiB;KACtC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACzC,OAAO,UAAU,CACf,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EACrE,SAAS,CAAC,MAAM,EAChB,OAAO,CACR,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,gCAAgC;QACpC,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR,iBAAiB,CAAC,IAAI,CAAC;YACvB,mEAAmE;YACnE,oEAAoE;YACpE,GAAG,qBAAqB,CAAC;gBACvB,4BAA4B;gBAC5B,GAAG,IAAI,CAAC,UAAU;aACnB,CAAC;SACH;KACF,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-readiness-operations.d.ts

@@ -0,0 +1,103 @@
+import type { ParsedWorkflow, ParsedWorkflowJob, ParsedWorkflowStep } from "./doctor-readiness-workflows.js";
+/** One command an automated job runs, with the file coordinates to cite it. */
+export interface ScannedCommand {
+    readonly workflow: string;
+    readonly jobId: string;
+    readonly command: string;
+}
+/** What one scan of a repository's workflows established. */
+export interface OperationScan {
+    /** Commands running in a job this file proves is automated and ungated. */
+    readonly ungated: readonly ScannedCommand[];
+    /** Commands running in a job something already gates. */
+    readonly gated: readonly ScannedCommand[];
+    /** Stated reasons a job's gating could not be settled offline. */
+    readonly unresolved: readonly string[];
+}
+/** Optional refinements a caller layers onto a scan. */
+export interface ScanOptions {
+    /**
+     * A job-level exemption, evaluated when a match is found. B1 uses it for a
+     * job that takes its own backup first: the destructive command is real, but
+     * the way back is right there in the same job.
+     */
+    readonly exemptJob?: (job: ParsedWorkflowJob) => boolean;
+    /**
+     * A workflow-level reason the match cannot be settled offline, returning
+     * `null` when it can. Used for triggers that make the operation obviously
+     * ephemeral — a per-pull-request teardown destroys what that same pull
+     * request created, so there is nothing durable for a gate to protect.
+     */
+    readonly unresolvedWorkflow?: (workflow: ParsedWorkflow) => string | null;
+    /**
+     * A job-level reason the match cannot be settled offline, returning `null`
+     * when it can. Used for a job that boots its own `services:` containers.
+     */
+    readonly unresolvedJob?: (job: ParsedWorkflowJob) => string | null;
+}
+/**
+ * Whether any text — a command, a job's `env:` block, or the two together —
+ * names an obviously ephemeral target.
+ * @param text - The text to screen (case is normalized here)
+ * @returns True when the text names throwaway state
+ */
+export declare function looksEphemeral(text: string): boolean;
+/**
+ * Whether one command is the kind of operation a producer is looking for. The
+ * job travels with the command because the evidence that settles the question
+ * is often outside the command text — a job `env:` block naming a CI database,
+ * for instance.
+ */
+export type CommandPredicate = (command: string, job: ParsedWorkflowJob) => boolean;
+/**
+ * Whether a workflow's declared triggers prove it runs without a human. A
+ * workflow that declares no `on:` block this parser could read is treated as
+ * NOT automated, because absence of a readable trigger is absence of proof.
+ * @param workflow - The parsed workflow
+ * @returns True when at least one trigger fires with no human in the loop
+ */
+export declare function runsUnattended(workflow: ParsedWorkflow): boolean;
+/**
+ * Whether anything in the file already gates this job. A declared
+ * `environment:` counts even though its protection rules are unreadable
+ * offline: the operator has named a deployment boundary, and calling that
+ * ungated would be exactly the false positive this module exists to prevent.
+ * @param job - The parsed job
+ * @returns True when the job is conditional or names an environment
+ */
+export declare function jobIsGated(job: ParsedWorkflowJob): boolean;
+/**
+ * Whether a step is individually gated — a conditional step, or a command that
+ * names its own confirmation or rehearsal switch.
+ * @param step - The parsed step
+ * @returns True when the step carries its own guard
+ */
+export declare function stepIsGated(step: ParsedWorkflowStep): boolean;
+/**
+ * Scan every workflow for the commands matching a predicate, partitioned by
+ * whether the file itself proves the command runs unattended and ungated.
+ * @param workflows - Parsed workflows
+ * @param matches - Predicate over a lower-cased `run` command
+ * @param options - Scan refinements
+ * @returns The partitioned scan
+ */
+export declare function scanCommands(workflows: readonly ParsedWorkflow[], matches: CommandPredicate, options?: ScanOptions): OperationScan;
+/**
+ * Whether the repository checks in an automation runbook — the "way back" half
+ * of B1 and B4. The `automation-runbook-contract` rule puts them under
+ * `.lisa/automations/*.runbook.md`; the conventional documentation homes are
+ * honored as well, so a project that writes its recovery procedure somewhere
+ * reasonable is never told it has none.
+ * @param root - Repository root
+ * @returns True when at least one runbook is checked in
+ */
+export declare function hasCheckedInRunbook(root: string): Promise<boolean>;
+/**
+ * Render scanned commands as one evidence string, quoting the file, the job, and
+ * the command so the operator can go straight to the line.
+ * @param commands - The commands to cite
+ * @param limit - Most commands to quote before summarizing the remainder
+ * @returns One evidence string
+ */
+export declare function describeCommands(commands: readonly ScannedCommand[], limit: number): string;
+//# sourceMappingURL=doctor-readiness-operations.d.ts.map

package/dist/cli/doctor-readiness-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-operations.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-operations.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,iCAAiC,CAAC;AAEzC,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,6DAA6D;AAC7D,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,OAAO,CAAC;IACzD;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,KAAK,MAAM,GAAG,IAAI,CAAC;IAC1E;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,MAAM,GAAG,IAAI,CAAC;CACpE;AAsBD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,iBAAiB,KACnB,OAAO,CAAC;AAiBb;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAMhE;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAa7D;AAwDD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,SAAS,cAAc,EAAE,EACpC,OAAO,EAAE,gBAAgB,EACzB,OAAO,GAAE,WAAgB,GACxB,aAAa,CAef;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWxE;AAsBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,SAAS,cAAc,EAAE,EACnC,KAAK,EAAE,MAAM,GACZ,MAAM,CAaR"}

package/dist/cli/doctor-readiness-operations.js

@@ -0,0 +1,207 @@
+/**
+ * Shared consequential-operation scanning for the B1 and B4 readiness producers
+ * (PRD #1739, #1896).
+ *
+ * B1 ("a realistic path causes silent data loss") and B4 ("a consequential
+ * operation has no gate and no recovery") ask different questions about the same
+ * raw material: a command an automated pipeline runs. They therefore share one
+ * definition of what counts as *automated* and what counts as *gated*, so the
+ * two producers cannot drift into disagreeing about the same workflow file.
+ *
+ * Everything here is written to be wrong in the safe direction. These are the
+ * two most false-positive-prone blockers in the rubric, and a standing blocker
+ * flips the entire repository to `NOT_READY` no matter what status the finding
+ * carries. So a guard this module cannot see is treated as a guard that exists:
+ * a conditional step, a conditional job, a declared environment, a manual-only
+ * trigger, or a reusable workflow whose caller is invisible all mean "not
+ * provable from this file", and not-provable never stands a blocker.
+ * @module cli/doctor-readiness-operations
+ */
+import { readdir } from "node:fs/promises";
+import * as path from "node:path";
+/**
+ * Targets that mark an operation as aimed at throwaway state — a CI database,
+ * a per-pull-request preview stack, a scratch stage. A pipeline that tears down
+ * what it just built is doing the correct thing, and reporting it as an ungated
+ * consequential operation is the archetypal false positive for both B1 and B4.
+ * Shared by both producers so they cannot drift apart on what "ephemeral" means.
+ */
+const EPHEMERAL_TARGETS = [
+    /(^|[^a-z0-9])test([^a-z0-9]|$)/,
+    /_test\b/,
+    /-test\b/,
+    /\blocalhost\b/,
+    /\b127\.0\.0\.1\b/,
+    /(^|[^a-z0-9])(tmp|temp)([^a-z0-9]|$)/,
+    /(^|[^a-z0-9])pr-/,
+    /\bpreview\b/,
+    /github\.event\.number/,
+    /\bpull_request\b/,
+];
+/**
+ * Whether any text — a command, a job's `env:` block, or the two together —
+ * names an obviously ephemeral target.
+ * @param text - The text to screen (case is normalized here)
+ * @returns True when the text names throwaway state
+ */
+export function looksEphemeral(text) {
+    const normalized = text.toLowerCase();
+    return EPHEMERAL_TARGETS.some(pattern => pattern.test(normalized));
+}
+/**
+ * Triggers that mean the workflow does not run itself. `workflow_dispatch` puts
+ * a human at the console, and `workflow_call` hides the caller from an offline
+ * read — neither is a path this module may call automated.
+ */
+const NON_AUTOMATED_EVENTS = [
+    "workflow_dispatch",
+    "workflow_call",
+];
+/**
+ * Whether a workflow's declared triggers prove it runs without a human. A
+ * workflow that declares no `on:` block this parser could read is treated as
+ * NOT automated, because absence of a readable trigger is absence of proof.
+ * @param workflow - The parsed workflow
+ * @returns True when at least one trigger fires with no human in the loop
+ */
+export function runsUnattended(workflow) {
+    // An empty trigger list yields `false` here, which is the intended reading:
+    // a workflow whose `on:` block could not be parsed proves nothing.
+    return workflow.on.events.some(event => !NON_AUTOMATED_EVENTS.includes(event));
+}
+/**
+ * Whether anything in the file already gates this job. A declared
+ * `environment:` counts even though its protection rules are unreadable
+ * offline: the operator has named a deployment boundary, and calling that
+ * ungated would be exactly the false positive this module exists to prevent.
+ * @param job - The parsed job
+ * @returns True when the job is conditional or names an environment
+ */
+export function jobIsGated(job) {
+    return job.ifCondition !== "" || job.environment.length > 0;
+}
+/**
+ * Whether a step is individually gated — a conditional step, or a command that
+ * names its own confirmation or rehearsal switch.
+ * @param step - The parsed step
+ * @returns True when the step carries its own guard
+ */
+export function stepIsGated(step) {
+    if (step.ifCondition !== "") {
+        return true;
+    }
+    const command = step.run.toLowerCase();
+    return (
+    // `-dryrun` covers the AWS CLI's own hyphen-less spelling and the
+    // double-dashed one; `--dry-run` is the GNU-style form everything else uses.
+    command.includes("--dry-run") ||
+        command.includes("-dryrun") ||
+        command.includes("--require-approval") ||
+        command.includes("inputs.confirm"));
+}
+/**
+ * State the reason one job's exposure could not be settled from the file alone.
+ * @param workflow - The workflow declaring the job
+ * @param job - The job that matched
+ * @returns One operator-language reason line
+ */
+function unresolvedReason(workflow, job) {
+    return (`\`${workflow.file}\` job \`${job.id}\` runs a consequential operation, but ` +
+        "the workflow only starts from a manual dispatch or from a caller this " +
+        "offline read cannot see, so whether it ever runs unattended is not " +
+        "established either way");
+}
+/**
+ * Classify every matching step in one job.
+ * @param workflow - The workflow declaring the job
+ * @param job - The job to classify
+ * @param matches - Predicate over a lower-cased `run` command
+ * @param options - Scan refinements
+ * @returns The classified outcomes for this job (empty when nothing matched)
+ */
+function classifyJob(workflow, job, matches, options) {
+    const hits = job.steps.filter(step => step.run !== "" && matches(step.run.toLowerCase(), job));
+    if (hits.length === 0) {
+        return [];
+    }
+    if (!runsUnattended(workflow)) {
+        return [{ kind: "unresolved", reason: unresolvedReason(workflow, job) }];
+    }
+    const deferred = options.unresolvedWorkflow?.(workflow) ?? options.unresolvedJob?.(job);
+    if (deferred !== undefined && deferred !== null) {
+        return [{ kind: "unresolved", reason: deferred }];
+    }
+    const jobGated = jobIsGated(job) || (options.exemptJob?.(job) ?? false);
+    return hits.map(step => ({
+        kind: jobGated || stepIsGated(step) ? "gated" : "ungated",
+        command: { workflow: workflow.file, jobId: job.id, command: step.run },
+    }));
+}
+/**
+ * Scan every workflow for the commands matching a predicate, partitioned by
+ * whether the file itself proves the command runs unattended and ungated.
+ * @param workflows - Parsed workflows
+ * @param matches - Predicate over a lower-cased `run` command
+ * @param options - Scan refinements
+ * @returns The partitioned scan
+ */
+export function scanCommands(workflows, matches, options = {}) {
+    const outcomes = workflows.flatMap(workflow => workflow.jobs.flatMap(job => classifyJob(workflow, job, matches, options)));
+    return {
+        ungated: outcomes.flatMap(outcome => outcome.kind === "ungated" ? [outcome.command] : []),
+        gated: outcomes.flatMap(outcome => outcome.kind === "gated" ? [outcome.command] : []),
+        unresolved: outcomes.flatMap(outcome => outcome.kind === "unresolved" ? [outcome.reason] : []),
+    };
+}
+/**
+ * Whether the repository checks in an automation runbook — the "way back" half
+ * of B1 and B4. The `automation-runbook-contract` rule puts them under
+ * `.lisa/automations/*.runbook.md`; the conventional documentation homes are
+ * honored as well, so a project that writes its recovery procedure somewhere
+ * reasonable is never told it has none.
+ * @param root - Repository root
+ * @returns True when at least one runbook is checked in
+ */
+export async function hasCheckedInRunbook(root) {
+    const holdsRunbooks = await Promise.all([
+        directoryHolds(root, path.join(".lisa", "automations"), ".runbook.md"),
+        ...["wiki/runbooks", "docs/runbooks", "runbooks"].map(async (candidate) => 
+        // An EMPTY directory is not a recovery procedure. Accepting one would
+        // make `mkdir runbooks` a one-command switch for turning B1 and B4 off.
+        await directoryHolds(root, candidate, ".md")),
+    ]);
+    return holdsRunbooks.includes(true);
+}
+/**
+ * Whether a repository directory holds at least one file with a given suffix.
+ * @param root - Repository root
+ * @param relativePath - Repo-relative directory path
+ * @param suffix - Required file-name suffix
+ * @returns True when the directory exists and holds a matching file
+ */
+async function directoryHolds(root, relativePath, suffix) {
+    try {
+        const entries = await readdir(path.join(root, ...relativePath.split("/")));
+        return entries.some(entry => entry.endsWith(suffix));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Render scanned commands as one evidence string, quoting the file, the job, and
+ * the command so the operator can go straight to the line.
+ * @param commands - The commands to cite
+ * @param limit - Most commands to quote before summarizing the remainder
+ * @returns One evidence string
+ */
+export function describeCommands(commands, limit) {
+    const shown = commands.slice(0, limit);
+    const overflow = commands.length - shown.length;
+    const lines = shown.map(entry => `\`${entry.workflow}\` job \`${entry.jobId}\` runs \`${entry.command}\``);
+    return (lines.join(" | ") +
+        (overflow > 0
+            ? ` | (+${overflow} further operation(s) of the same kind)`
+            : ""));
+}
+//# sourceMappingURL=doctor-readiness-operations.js.map

package/dist/cli/doctor-readiness-operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-operations.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AA8ClC;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAsB;IAC3C,gCAAgC;IAChC,SAAS;IACT,SAAS;IACT,eAAe;IACf,kBAAkB;IAClB,sCAAsC;IACtC,kBAAkB;IAClB,aAAa;IACb,uBAAuB;IACvB,kBAAkB;CACnB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AACrE,CAAC;AAkBD;;;;GAIG;AACH,MAAM,oBAAoB,GAAsB;IAC9C,mBAAmB;IACnB,eAAe;CAChB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAwB;IACrD,4EAA4E;IAC5E,mEAAmE;IACnE,OAAO,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAC5B,KAAK,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC/C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,GAAsB;IAC/C,OAAO,GAAG,CAAC,WAAW,KAAK,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,IAAI,IAAI,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;IACvC,OAAO;IACL,kEAAkE;IAClE,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,QAAwB,EACxB,GAAsB;IAEtB,OAAO,CACL,KAAK,QAAQ,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,yCAAyC;QAC7E,wEAAwE;QACxE,qEAAqE;QACrE,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,QAAwB,EACxB,GAAsB,EACtB,OAAyB,EACzB,OAAoB;IAEpB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAC3B,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,CAChE,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GACZ,OAAO,CAAC,kBAAkB,EAAE,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC;IACzE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvB,IAAI,EACF,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,OAAiB,CAAC,CAAC,CAAE,SAAmB;QAC3E,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;KACvE,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAoC,EACpC,OAAyB,EACzB,UAAuB,EAAE;IAEzB,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAC5C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAC3E,CAAC;IACF,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAClC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CACpD;QACD,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAChC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAClD;QACD,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CACrC,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CACtD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACtC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC;QACtE,GAAG,CAAC,eAAe,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC,GAAG,CACnD,KAAK,EAAC,SAAS,EAAC,EAAE;QAChB,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAC/C;KACF,CAAC,CAAC;IACH,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,IAAY,EACZ,YAAoB,EACpB,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3E,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAmC,EACnC,KAAa;IAEb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CACrB,KAAK,CAAC,EAAE,CACN,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,KAAK,aAAa,KAAK,CAAC,OAAO,IAAI,CAC3E,CAAC;IACF,OAAO,CACL,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QACjB,CAAC,QAAQ,GAAG,CAAC;YACX,CAAC,CAAC,QAAQ,QAAQ,yCAAyC;YAC3D,CAAC,CAAC,EAAE,CAAC,CACR,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-readiness-shared.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Read a repository-relative file, returning null when it cannot be read.
+ *
+ * Reading is best-effort by design: a file that cannot be read establishes
+ * nothing, and a readiness producer must never turn "could not look" into
+ * either a violation or a clean bill of health.
+ * @param root - Repository root
+ * @param relativePath - Repo-relative path (forward slashes)
+ * @returns File contents, or null
+ */
+export declare function readFileOrNull(root: string, relativePath: string): Promise<string | null>;
+/**
+ * Whether a repository-relative directory exists.
+ * @param root - Repository root
+ * @param relativePath - Repo-relative directory path
+ * @returns True when the directory could be listed
+ */
+export declare function directoryExists(root: string, relativePath: string): Promise<boolean>;
+/**
+ * Whether a repository-relative path exists, as a file or a directory.
+ * @param root - Repository root
+ * @param relativePath - Repo-relative path
+ * @returns True when something is present at that path
+ */
+export declare function pathExists(root: string, relativePath: string): Promise<boolean>;
+/**
+ * Strip leading and trailing slashes from a repo-relative path fragment.
+ * Written without a regex quantifier so it cannot backtrack on hostile input.
+ * @param value - The path fragment
+ * @returns The fragment with empty segments removed
+ */
+export declare function trimSlashes(value: string): string;
+/**
+ * Whether a value is a plain JSON object.
+ * @param value - Candidate value
+ * @returns True when the value is a non-null, non-array object
+ */
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+/**
+ * Wrap non-blocking observations as findings. They deliberately carry no
+ * `blocker` key: naming one would stand a blocker up — and flip the whole
+ * repository to `NOT_READY` — on an observation that was never decidable.
+ * @param notes - Informational lines
+ * @returns Findings, one per note
+ */
+export declare function informationalFindings(notes: readonly string[]): readonly Record<string, unknown>[];
+//# sourceMappingURL=doctor-readiness-shared.d.ts.map

package/dist/cli/doctor-readiness-shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-shared.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-shared.ts"],"names":[],"mappings":"AAeA;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKjD;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAEpC"}